fixed security hole

if using cache, there's no authentication test, and this API is open to the unauthorized user until the cache is invalidated.